Technical Description

Mandriva has released updated packages to address multiple vulnerabilities identified in PHP. These flaws could be exploited by attackers to execute arbitrary commands or cause a denial of service. For additional information, see : VUPEN/ADV-2006-1500

Affected Products

Mandriva Linux 10.2
Mandriva Linux 2006.0
Corporate 3.0
Multi Network Firewall 2.0

Solution

Upgrade the affected packages :

Mandriva Linux 10.2:
463d4dd124e7e161159703976b35344d 10.2/RPMS/libphp_common432-4.3.10-7.12.102mdk.i586.rpm
0a71e94de99b08ba787b23ef64c10357 10.2/RPMS/php432-devel-4.3.10-7.12.102mdk.i586.rpm
cfcaf5c400bd4d7ca64a2ae25eccb0b7 10.2/RPMS/php-cgi-4.3.10-7.12.102mdk.i586.rpm
321b4cad92d82d9bcd1f18170390f8ae 10.2/RPMS/php-cli-4.3.10-7.12.102mdk.i586.rpm
1bf084222c4f33676432bfb516d71582 10.2/SRPMS/php-4.3.10-7.12.102mdk.src.rpm

Mandriva Linux 10.2/X86_64:
54243bc33bd55e326aa05f321f767442 x86_64/10.2/RPMS/lib64php_common432-4.3.10-7.12.102mdk.x86_64.rpm
c1a6b0c185e4b39404493290cb80f86f x86_64/10.2/RPMS/php432-devel-4.3.10-7.12.102mdk.x86_64.rpm
b643924edc6d25dfeecdbb1cef532341 x86_64/10.2/RPMS/php-cgi-4.3.10-7.12.102mdk.x86_64.rpm
d393dc26dadaadf34fc6b7b44ee46399 x86_64/10.2/RPMS/php-cli-4.3.10-7.12.102mdk.x86_64.rpm
1bf084222c4f33676432bfb516d71582 x86_64/10.2/SRPMS/php-4.3.10-7.12.102mdk.src.rpm

Mandriva Linux 2006.0:
cbb4891a5ab88238d462a66e7363119e 2006.0/RPMS/libphp5_common5-5.0.4-9.9.20060mdk.i586.rpm
dd77930acc185da44c6946252d445438 2006.0/RPMS/php-cgi-5.0.4-9.9.20060mdk.i586.rpm
5de2486af340d1fe387f7ecafdf85df1 2006.0/RPMS/php-cli-5.0.4-9.9.20060mdk.i586.rpm
6dd3b49d29cc28508ea3efdb69e72a79 2006.0/RPMS/php-devel-5.0.4-9.9.20060mdk.i586.rpm
8e074aedcbd3126797bbe11c93e5bd04 2006.0/RPMS/php-fcgi-5.0.4-9.9.20060mdk.i586.rpm
f144d3a41b04047b9d8c536a37aa94e1 2006.0/SRPMS/php-5.0.4-9.9.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
2e0821b3b925cc9c37391b061045c303 x86_64/2006.0/RPMS/lib64php5_common5-5.0.4-9.9.20060mdk.x86_64.rpm
c0ad86b0b332c058a9a18f5a41aca912 x86_64/2006.0/RPMS/php-cgi-5.0.4-9.9.20060mdk.x86_64.rpm
3c1ed4a2f1063fc53aec7a776af24939 x86_64/2006.0/RPMS/php-cli-5.0.4-9.9.20060mdk.x86_64.rpm
855bd247b561da4284eacbab95432123 x86_64/2006.0/RPMS/php-devel-5.0.4-9.9.20060mdk.x86_64.rpm
c504785298c305fd107ea6fdeff52211 x86_64/2006.0/RPMS/php-fcgi-5.0.4-9.9.20060mdk.x86_64.rpm
f144d3a41b04047b9d8c536a37aa94e1 x86_64/2006.0/SRPMS/php-5.0.4-9.9.20060mdk.src.rpm

Corporate 3.0:
bb6a0d81b011c1f859fb741544154b07 corporate/3.0/RPMS/libphp_common432-4.3.4-4.16.C30mdk.i586.rpm
e2d7f6bc462561ade323f97558491e8a corporate/3.0/RPMS/php432-devel-4.3.4-4.16.C30mdk.i586.rpm
61f46043b662e05c6eb33ab9ca28661a corporate/3.0/RPMS/php-cgi-4.3.4-4.16.C30mdk.i586.rpm
8ca7582e4edab0bf77f260247401d94d corporate/3.0/RPMS/php-cli-4.3.4-4.16.C30mdk.i586.rpm
b411e308d530cc2879b3087eb3f0f016 corporate/3.0/SRPMS/php-4.3.4-4.16.C30mdk.src.rpm

Corporate 3.0/X86_64:
9cdb80932f1e0a551fe6e494b4fe7436 x86_64/corporate/3.0/RPMS/lib64php_common432-4.3.4-4.16.C30mdk.x86_64.rpm
9027c979fa2b6b05917941f51c621a0a x86_64/corporate/3.0/RPMS/php432-devel-4.3.4-4.16.C30mdk.x86_64.rpm
b1fad86cb60c067daebba9383d033c84 x86_64/corporate/3.0/RPMS/php-cgi-4.3.4-4.16.C30mdk.x86_64.rpm
d43daff0afa35122d1dfa29291b94fd3 x86_64/corporate/3.0/RPMS/php-cli-4.3.4-4.16.C30mdk.x86_64.rpm
b411e308d530cc2879b3087eb3f0f016 x86_64/corporate/3.0/SRPMS/php-4.3.4-4.16.C30mdk.src.rpm

Multi Network Firewall 2.0:
9bb29e292e0f7612bd3ca38762262c85 mnf/2.0/RPMS/libphp_common432-4.3.4-4.16.M20mdk.i586.rpm
9ad22ab66b3523d634dad69e126f7f44 mnf/2.0/RPMS/php432-devel-4.3.4-4.16.M20mdk.i586.rpm
6d130a0f45e5a23b1134a2ef5a721995 mnf/2.0/RPMS/php-cgi-4.3.4-4.16.M20mdk.i586.rpm
725f1e0d0fa61e2a912f2899225b6f87 mnf/2.0/RPMS/php-cli-4.3.4-4.16.M20mdk.i586.rpm
29c7cfe26747e0fcd9168448e47dbc75 mnf/2.0/SRPMS/php-4.3.4-4.16.M20mdk.src.rpm

References

http://www.vupen.com/english/advisories/2006/1970
http://www.frsirt.com/english/reference/12258

ChangeLog

2006-05-24 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.